REMARKS 

Claims 1-20 are pending. Claims 1-20 are rejected. Claims 1, 6, 8, 10, 14 and 20 
are amended. This Response is filed in reply to the Office Action dated November 28, 
2003 . 

Amendments to the claims are not an acquiescence to any of the rejections. 
Furthermore, silence with regard to any of the Examiner's rejections is not an 
acquiescence to such rejections. Specifically, silence with regard to Examiner's rejection 
of a dependent claim, when such claim depends from an independent claim that 
Applicants consider allowable for reasons provided herein, is not an acquiescence to such 
rejection of the dependent claim(s), but rather a recognition by Applicants that such 
previously lodged rejection is moot based on Applicants' remarks and/or amendments 
relative to the independent claims (that Applicants consider allowable) from which the 
dependent claim(s) depends. Applicants reserve the option to further prosecute the same 
or similar claims in the instant or a subsequent application. Upon entry of the 
Amendment, claims 1-20 are pending in the present application. 

The issues of the subject Office Action are presented below with reference to 
paragraph markings of the Office Action: 

With regard to the Office Action, paragraph entitled "Drawings:" The Examiner objected 
to the drawings, contending that the following claimed features were not shown in the 
drawings: an expected port and an actual port (claim 1); discarding the packet (claim 3); 
generating an alert (claim 4); Internet Protocol packet (claim 5); and plurality of expected 
ports (claim 9). 

Applicants remind Examiner that 37 CFR 1.83(a) is a rule that is governed by 35 
U.S.C. 113. 35 U.S.C. 1 13 states that the "applicant shall furnish a drawing where 
necessary for the understanding of the subject matter sought to be presented." 
Accordingly, contrary to Examiner's statement, it is not necessary that the "drawings 
must show every feature of the invention specified in the claims." Applicants request 
that the Examiner seek supervisory advice on the interaction of 35 U.S.C. 1 13 and 37 
CFR 1.83(a). 
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Regardless of the Examiner's misapplication of 37 CFR 1.83(a), Applicants note 
that claims 1-7 recite a method for detecting spurious network traffic, as shown in Fig. 5. 
Block 312 of Fig. 5 shows receiving a network packet. The specification notes that the 
network packet is received on a port of the switch 100, i.e., one of the ports 104 of switch 
100, shown in Fig. 2, and that this port is referred to as the "actual port". Block 316 of 
Fig. 5 showsdetermining the expected switch source. The specification indicates that in 
step 316, the expected switch source, or expected port, is determined. Thus, Applicants 
respectfully submit that the limitations of determining the expected port and determining 
the actual port, as recited in claim 1, are shown in the drawings. Further, block 316 can 
illustrate a means for determining the expected switch source. The specification 
describes different approaches for determining the expected switch source including one 
approach wherein more than one expected switch source, i.e., a plurality of expected 
switch sources, can be determined. Thus, Applicants respectfully submit that the 
limitation of a determining means for determining a plurality of expected ports, as recited 
in claim 9, is shown in the drawings. 

Block 320 of Fig. 5 shows spurious packet handling. As provided in the 
specification, spurious packet handling 320 can include various handling options, 
including discarding the packet and/or generating an alert, as recited in claims 3 and 4, 
respectively. Block 312 of Fig. 5 shows receiving a network packet. The specification 
describes the networks as including networks configured to send and/or receive Internet 
Protocol datagrams, or packets, and/or networks that are portions of the Internet 
communicating using the Transport Control Protocol and Internet Protocol (TCP/IP). 
Thus, Applicants respectfully submit that the limitations of discarding a packet, 
generating an alert, and the packet being an Internet Protocol packet, as recited in claims 
3, 4, and 5, respectively, are shown in the drawings and more fully described in the 
specification. 

Applicants thus traverse the Examiner's Drawing objections. 

With regard to the Office Action, paragraph entitled "Claim Objections:" The Examiner 
objected to informalities in claims 3, 6, 10, 14 and 17. In claim 3, the Examiner contends 
it is unclear whether "the packet" (line 14) being discarded is from the actual port or the 
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expected port. In claim 6, the Examiner contends there is insufficient antecedent bases 
for the limitations "the routing tree" and "an expected port" (lines 4 and 5). In claim 10, 
the Examiner contends that in the limitation "a one of the plurality of ports (line 7) either 
"a" or "one" should be removed. In claim 14, the Examiner contends that there is 
insufficient antecedent basis for the limitation "the source network address (line 2). In 
claiml7, the Examiner contends that the meaning of the ternr "therewith" (line 2) is 
unclear. 

With respect to the informalities, claim 3 does not recite that a packet is present in 
two different ports. Applicants submit that claim 3 clearly recites that the packet being 
discarded in claim 3 is the packet received, as recited in claim 1 . With respect to claim 
17, the term "therewith" has the clear and plain meaning "with it", as provided in The 
American Heritage Dictionary of the English Language, 4th Edition, Houghton Mifflin 
Company. Applicants fail to understand the Examiner's confusion with respect to claim 
17. Claims 6 and 14 are amended to provide proper antecedent basis for the limitations 
recited therein. Claim 10 is amended to more clearly recite the first and second ports. 
With respect to the rejections of claims 1 and 6 under 35 U.S. C. 1 12, second paragraph, 
claim 1 is amended to more clearly recite the actual and expected ports, and claim 6 is 
amended to more clearly recite the calculation of the expected path. Applicants thus 
traverse the Examiner's claim objections. 

With regard to the Office Action, paragraph entitled "Claim Rejections - 35 U.S.C. 
$112:" The Examiner rejected claims 1 and 6 under 35 U.S.C. 112, second paragraph, as 
being unclear. The Examiner contends it is unclear whether "the port" (in line 5 of claim 
1) refers to "a port" (in line 3). The Examiner contends it is unclear what "concluding" 
(in line 5 of claim 6) means regarding an expected port. 

Applicant amends claims 1 and 6 to traverse the Examiner's rejections thereof. 

With regard to the Office Action, paragraphs entitled "Claim Rejections - 35 U.S.C. 
§103:" The Examiner rejected claims 1, 3 and 8 over Sugiyama, U.S. Patent Ser. No. 
5,477,547, in view of Khansari, U.S. Patent Ser. No. 6,446,131; claims 2, 7 and 9 further 
in view of Dobbins, U.S. Patent Ser. No. 5,946,308; claim 4 over Sugiyama and 
Khansari and further in view of Miklos, U.S. Patent Ser. No. 6,621,796; claim 5 over 
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Sugiyama and Khansari in view of Kadambi, U.S. Patent Ser. No. 6,104,696; claim 6 
over Sugiyama and Khansari in view of Spiegel, U.S. Patent Ser. No. 5,649,108; claims 
10, 12-14, 18 and 20 over Khansari in view of Sugiyama; claim 1 1 over Khansari and 
Sugiyama, further in view of Spiegel; claims 15 and 16 over Khansari and Sugiyama 
further in view of Dobbins; claim 17 over Khansari, Sugiyama and Dobbins, and further 
in view of Spiegel; claim 19 over Khansari and Sugiyama, and further in view of Miklos. 
Applicants traverse the Examiner's rejections and respectfully request reconsideration in 
view of the amendments and remarks. 

Applicants note that in contrast to Applicants independent claims 1, 8, 10, and 20, 
Sugiyama does not disclose a method, system, switch, and/or network that determines an 
expected port on which a packet is expected to be received. Nor does Sugiyama disclose 
a method, system, switch, and/or network that compares an actual port upon which a 
packet is received to an expected port upon which the packet is expected to be received. 
Rather, Applicants direct the Examiner to Column 5 of Sugiyama that describes a bridge 
which includes a terminal address comparing circuit (47) and a LAN port address 
comparing circuit (46). The terminal address comparing circuit determines whether the 
destination address coincides with the address of an earlier learned node. The LAN port 
address comparing circuit compares a LAN port address corresponding with the 
destination, as read from a memory, with the LAN port address of the source in a setting 
circuit. The comparison determines if the terminal having the same address as the 
destination address is connected to the same LAN (col. 5, lines 46-53). A packet is 
discarded when the results of both comparisons indicate a coincidence, i.e., the 
destination address coincides with the address of an earlier learned node and the source 
and destination terminal exist on the same LAN, since there is no need to pass the packet 
(col. 9, lines 15-27). The packet is forwarded if the LAN port addresses do not coincide 
(col. 9, lines 35-48). 

Sugiyama thus does not teach or suggest determining an expected port, as recited 
in Applicants' independent claim 1. Sugiyama determines if the destination address 
coincides with an earlier learned node address, and whether the LAN port address of the 
source node (comparable to Applicants' actual port) coincides with the LAN port address 
of the destination node. Applicants did not find any reference in Sugiyama relating to an 
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expected port or equivalent thereof. The Examiner contends that the learning circuit (57) 
configures the interface port toward the LAN as the expected port for packets from the 
LAN. However, Applicants respectfully disagree with the Examiner's interpretation, and 
note that the learning circuit in Sugiyama has the function of learning which nodes 
(terminals) are connected to LAN 10 (col. 4, lines 34 and 35), i.e., the learning circuit 
serves to create a listing'of addresses associated with LAN port addresses. Based on the 
description of the learning circuit in Sugiyama, if a spurious packet was received, the 
learning circuit would merely associate the incorrect source address with the LAN port 
address. The learning circuit does not provide a means for determining an expected port 
for a packet, as provided in Applicants' independent claims. Thus, without the means for 
determining an expected port, Sugiyama cannot be seen to teach or suggest comparing an 
actual port with an expected port, as is recited in Applicants' independent claims. 

As provided herein, the comparisons taught by Sugiyama do not teach or suggest 
Applicants' claimed comparison of an actual port with an expected port, since the 
comparing circuits in Sugiyama concern comparisons related to a destination address 
(Sugiyama circuit 47), and comparisons of the LAN address of actual port and the LAN 
address of the destination port (Sugiyama circuit 46). Thus, Sugiyama does not teach or 
suggest Applicants' independent claim 1 features of determining an expected port for the 
packet upon which the packet is expected to be received, determining an actual port for 
the packet upon which the packet is actually received, and comparing the actual port to 
the expected port. As correctly noted by the Examiner, Sugiyama also does not teach or 
suggest Applicants' claimed spurious packet handling when the actual port does not 
correspond to the expected port. 

Further, Khansari also does not disclose a method, system, switch, and/or network 
for comparing the actual port to the expected port, and providing packet handling when 
the actual port does not correspond to the expected port, all as claimed in Applicants' 
independent claim 1 . Rather, Khansari, in Column 6, describes a bridge using a simple 
protocol to filter duplicate frames and learn about nodes connected to a network, without 
the need to run a Spanning Tree algorithm. The Khansari learning module reads the 
source address of a frame, or packet, and determines whether a port number 
corresponding to the source address in a database is the same as an inbound port number. 
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If not, the bridge determines whether an identical frame was already received on a 
different port. The frame is discarded if an identical frame was already received on a 
different port (col. 6, lines 35-63 and Fig. 7). In contrast to Applicants' independent 
claim 1, Khansari does not teach spurious packet handling, and further, if a spurious 
packet is received by Khansari, i.e., a packet including an incorrect source address yet not 
being a duplicate of a previous frame, Khansari will simply record the address and port 
number to the database and forward the packet (col. 7, lines 4-11 and Fig. 7). 

Thus, Khansari, alone or in combination with Sugiyama, does not teach or suggest 
providing spurious packet handling when the actual port does not correspond to the 
expected port, as recited in Applicants' independent claim 1. As described above, 
Khansari teaches that determining whether an identical frame was already received on a 
different port is performed after determining whether a port number corresponding to the 
source address in a database is the same as an inbound port number and prior to 
discarding the packet. Applicants' claimed method, as recited in independent claim 1, 
provides spurious packet handling when the actual port does not correspond to the 
expected port and does not have the intermediate step as taught by Khansari. 

Similarly, Sugiyama and Khansari, alone or in combination, do not teach or 
suggest a system for detecting spurious network traffic including a comparing means for 
comparing the expected port and the actual port, and handling means for providing 
spurious packet handling upon determining that the actual port does not correspond to 
the expected port, as recited in Applicants' independent claim 8. Sugiyama and 
Khansari, alone or in combination, do not teach or suggest a switch and/or an 
internetwork having a processor configured to compare a first port of a plurality of ports 
through which a packet is received to a second port of the plurality of ports through 
which the packet is expected to be received, and further configured to provide spurious 
packet handling upon determining that the first port is different from the second port, as 
recited in Applicants' independent claims 10 and 20, respectively. 

The Examiner thus fails to provide a prima facie case of obviousness at least 
because the Examiner's proposed combinations of references fail to show all features of 
the Applicants' independent claims. Accordingly, Applicants consider independent 
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claims 1, 8, 10 and 20 to be allowable. Claims 2-7, 9 and 11-19 depend respectively 
from allowable independent claims 1, 8 and 10 and are deemed allowable at least by 
dependency. Applicants' silence with regard to the other requirements of the prima facie 
case of obviousness should not be construed as an acquiescence that such requirements 
are satisfied, but rather, a recognition that a discussion of such requirements is moot 
based on the failure of the Examiner to show that the proposed combination of cited art 
shows all of Applicants' claimed features. 

Applicants respectfully request reconsideration of the rejections of the claims 
remaining in the Application and suggest that the claims are in condition for allowance in 
light of the above. The remarks herein should in no way be construed to be an 
acquiescence to any of the rejections. The remarks herein are being made solely to 
expedite the prosecution of the above-identified application. Applicants reserve the 
option to further prosecute the same or similar claims in the instant or subsequent patent 
applications. 



Based on the above amendments and remarks, it is respectfully submitted that the 
claims and thus this application are in condition for allowance. Accordingly, allowance 
is requested. If there are any remaining issues or the Examiner believes that a telephone 
conversation with Applicants' attorney would be helpful in expediting the prosecution of 
this application, the Examiner is invited to call the undersigned at (972) 718-4800. 



Verizon Corporate Services Group Inc. 

c/o Christian Andersen 

600 Hidden Ridge, HQE03H14 

Irving, TX 75038 

Tel: (972) 718-4800 

CUSTOMER NO. 32127 



CONCLUSION 



Respectfully submitted, 



Date: May 28, 2004 




Joel Wall 

Attorney im Applicant 
Registration No. 25,648 
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